Source-linked AI summary
Proof of Luck: an Efficient Blockchain Consensus Protocol
Mitar Milutinovic, Warren He, Howard Wu, Maxinder Kanwal
TL;DR
Existing proof-of-work blockchains require substantial computation, energy, and time for consensus. The paper develops TEE-enabled proof-of-work, proof-of-time, proof-of-ownership, and proof-of-luck designs; its proof-of-luck blockchain provides low-latency validation, deterministic confirmation time, negligible energy consumption, and equitably distributed mining. The authors also analyze liveness and persistence and discuss protection against a constant number of compromised TEEs.
Problem
Proof-of-work blockchains consume computation time, energy, and silicon, and Bitcoin’s confirmation process can be too slow for applications such as point-of-sale transactions.
Method
The paper develops TEE-enabled consensus primitives and combines them into a proof-of-luck blockchain using trusted execution and attestation.
Results
The proof-of-luck blockchain achieves low-latency transaction validation, deterministic confirmation time, negligible energy consumption, and equitably distributed mining.
Takeaways & Limitations
The analysis reports liveness, persistence, energy-efficient mining, decentralized mining power, and a potential protection against a constant number of compromised TEEs.
Takeaways & Limitations
The protocol assumes the TEE security requirements hold for participants, and attacks compromising an entire trusted-platform vendor are outside the paper’s scope.
Abstract
from arXiv · showhide
In the paper, we present designs for multiple blockchain consensus primitives and a novel blockchain system, all based on the use of trusted execution environments (TEEs), such as Intel SGX-enabled CPUs. First, we show how using TEEs for existing proof of work schemes can make mining equitably distributed by preventing the use of ASICs. Next, we extend the design with proof of time and proof of ownership consensus primitives to make mining energy- and time-efficient. Further improving on these designs, we present a blockchain using a proof of luck consensus protocol. Our proof of luck blockchain uses a TEE platform's random number generation to choose a consensus leader, which offers low-latency transaction validation, deterministic confirmation time, negligible energy consumption, and equitably distributed mining. Lastly, we discuss a potential protection against up to a constant number of compromised TEEs.
1. INTRODUCTION
The paper uses trusted execution environments (TEEs) to address proof-of-work blockchains’ energy, hardware, and confirmation-time limitations. It introduces TEE-enabled consensus primitives and a proof-of-luck blockchain designed for efficient, low-latency, and equitable participation.
- Proof of work consumes computation time, energy, and silicon, while Bitcoin’s average ten-minute blocks and six-block recommendation delay transaction acceptance.These delays make proof-of-work consensus impractical for applications such as point-of-sale transactions.
- TEEs can enforce correct processing and limit the effect of Sybils operating under single hardware units.
- The paper presents three TEE-based drop-in consensus primitives: proof of work, proof of time, and proof of ownership.The primitives are described as energy-efficient replacements for existing consensus mechanisms.
- Proof of luck is a fourth consensus primitive whose blockchain design targets low-latency validation, deterministic confirmation time, negligible energy consumption, and equitably distributed mining.
- The design also discusses potential protection against an attacker controlling a small number of compromised TEEs.
2. RELATED WORK
Related work addresses blockchain energy use, transaction confirmation, and consensus under known participation, while highlighting trade-offs in security, scalability, timing assumptions, and hardware requirements.
- Alternative mechanisms such as proof of stake and proof of burn seek to reduce Bitcoin’s energy consumption, but their ability to maintain proof-of-work security properties and incentives remains unclear.
- Practical Byzantine fault tolerance reaches consensus within a few communications with up to one-third malicious participants when the participant set is known.However, it scales poorly, depends on network timing assumptions, and requires participant lists or trust relations in proposed improvements.
- Uncles and micro- and macro-blocks have been proposed to improve Bitcoin transaction confirmation times.The paper characterizes these approaches as orthogonal to its proposed advancements.
- Intel’s concurrent Sawtooth Lake work simulates Bitcoin mining energy-efficiently, whereas this paper adds consensus schemes, addresses compromised TEEs, and avoids estimating participant numbers.
3. PROBLEM DEFINITION
The paper formulates blockchain consensus as agreement on one shared state despite forks and incentives for participants to prefer competing states. It seeks quick deterministic confirmation, efficient communication and energy use, hardware resistance, and security under stated TEE assumptions.
- Consensus requires a distributed system to agree on a single shared state, although validation still permits multiple valid blockchain continuations.
- Participants may prefer their own state for rewards or double-spending, so the system must determine state without control by a minority of colluding malicious participants.
- The design goals include quick deterministic confirmations, energy- and communication-efficient operation, resistance to uncommon custom hardware, and no synchronized clock requirement.
- The threat model assumes suitable TEEs, unbiased attacker-influence-resistant random numbers, and detection of concurrent TEE invocations.
- The analysis considers adversaries controlling fewer than half of participants’ machines who cannot break cryptography or produce valid attestations after deviating from the protocol.
- Compromising an entire trusted-platform vendor is outside the paper’s scope because such an attack would affect systems beyond the blockchain.
4. BUILDING BLOCKS
The building blocks use TEEs to adapt proof of work, replace computation with time-based waiting, and limit hardware-based Sybils. These designs motivate consensus primitives that reduce energy use while preserving attested execution and pseudonymous uniqueness.
- Proof of Work: TEE-enabled proof of work restricts mining to supported platforms, which the paper associates with decentralized mining power, equitable rewards, and no mining-pool advantage.
- Proof of Work: TEE-enabled proof of work wraps an existing proof-of-work algorithm inside a TEE and returns attestation that the computation ran with unmodified code.In Bitcoin, the nonce is the newly mined block header and difficulty is the target hash.
- Proof of Time: Proof of time replaces proof-of-work computation with a TEE-enforced wait, allowing CPU cycles and energy to be saved for other work.The TEE uses relative timestamps, and a monotonic counter helps detect parallel instances on the same CPU.
- Proof of Ownership: Proof of ownership generates an attested proof using a nonce as the name base, causing proofs from one TEE for that base to share a pseudonym.Consensus can select the block with the most proofs carrying unique pseudonyms as leader.
5. PROOF OF LUCK
The proof of luck blockchain uses TEE-generated randomness and timed rounds to create blocks, selecting and preferring chains by accumulated luck. Its protocol validates chains, broadcasts better chains, and restarts mining when reconciliation changes the parent.
- Proof of Luck Primitive: Proof of luck builds a blockchain on a TEE-based primitive that generates proofs for participant-mined blocks.The blockchain uses the proof of luck primitive proposed in Algorithm 4.
- Mining Rounds: Each mining round binds participants to a chain, waits ROUND TIME, and then generates a block proof after validating the parent and elapsed time.PoLRound records the round block and trusted time; PoLMine checks the chain link and timing before sampling luck.
- Mining Rounds: PoLMine samples a uniform random luck value, delays proof release according to luck, and returns a TEE attestation containing the block nonce and luck.Luckier values receive shorter delays, allowing participants to suppress broadcasting inferior blocks received later.
- Block and Chain Validation: A block contains its parent hash, transactions, and proof, while chain validation checks transaction validity, attestations, hash links, and proof-data consistency.The validation algorithm traverses the chain from genesis to the latest block.
- Chain Selection: Participants adopt and broadcast valid chains with higher total luck, starting or restarting mining when the selected chain requires a different parent.Network reconciliation can therefore force a participant to restart mining on the updated chain.
- Protocol Operation: During normal operation, participants mine approximately once per ROUND TIME without synchronized clocks, while the protocol tends to synchronize rounds.Pending transactions are committed in callbacks and the resulting chain is sent for processing.
6. ANALYSIS
The analysis examines chain selection, mining fairness, confirmation timing, and resistance to minority attacks. It shows that minority takeover probability decreases exponentially with fork depth and that mining opportunity is proportional to participant-group size.
- Persistence against Minority Attacker: A minority attacker’s probability of producing a chain preferred over the majority decreases exponentially with the number of blocks after a fork.The analysis derives this result using a Chernoff bound and independence assumptions.
- Persistence against Minority Attacker: For block t, population luck is modeled using the maximum of uniform random variables for majority size M and minority size m.The analysis defines relative total luck after h blocks from a fork.
- Persistence against Minority Attacker: Because M > m, an s > 0 exists such that the relevant product of inner expectations is less than 1.This inequality supports the exponential bound on minority victory probability.
- Mining Fairness: Over time, the expected number of blocks mined by participant group A is proportional to the number of participants in A.Participants sample independently from identical distributions, giving each equal probability of generating the largest random number.
- Confirmation Time: A proposed ROUND TIME of 15 seconds yields confirmation times slightly above 15 seconds, comparable with Ethereum and faster than Bitcoin’s 10 minutes.The proposal is based partly on an observed Bitcoin median block propagation time of around 6.5 seconds.
7. COMPROMISED TEE
The extension protects proof-of-luck consensus against high-cost attacks on individual TEEs by merging the m luckiest blocks into deterministic super-blocks. Scoring each super-block by its least-lucky proof limits control even when up to m−1 CPUs are compromised.
- 7. COMPROMISED TEE: The protocol assumes that TEE security requirements hold for all participants and treats compromised TEEs through a mitigation extension.The paper describes violating these requirements as expensive but possible for a motivated attacker.
- 7.1 Luckiest m: Super-blocks deterministically merge the m normal blocks with the highest luck values.Participants create individual blocks, attach proofs of luck, and select the m luckiest blocks for merging.
- 7.1 Luckiest m: The super-block’s luck is its least-lucky proof value, so m−1 compromised CPUs cannot fully control it.For values l1 > ... > lm, the super-block uses lm as its overall luck.
- 7.1 Luckiest m: The extension records only the luckiest m proofs, making it more scalable than recording proofs from all participants.The SGX prototype also uses linkable quotes to ensure the m proofs come from different CPUs.
- 7.1 Luckiest m: Honest participants’ blocks often contain nearly identical transactions, allowing super-blocks to be compressed efficiently.Participants broadcast blocks to others extending the same blockchain before merging them.
8. CONCLUSION
The paper proposes TEE-enabled consensus primitives and combines them into a proof-of-luck blockchain. Its analysis reports liveness and persistence alongside energy-efficient mining, low-latency validation, deterministic confirmation, decentralized mining power, and potential protection against a constant number of compromised TEEs.
- 8. CONCLUSION: The paper proposes TEE-enabled proof of work, proof of time, and proof of ownership as building blocks for consensus systems.
- 8. CONCLUSION: The authors combine these primitives into a blockchain based on proof of luck.
- 8. CONCLUSION: The analysis reports liveness, persistence, energy-efficient mining, low-latency validation, deterministic confirmation time, and decentralized mining power.
- 8. CONCLUSION: The paper discusses potential protection against a constant number of compromised TEEs participating in the blockchain.